auth-review

Audit authentication and authorization designs for security weaknesses.

8|4|Updated Feb 7, 2026

Search Tags:#authorization #authentication #RBAC #JWT #auth #security-review #ABAC

Ready to run

npx skills add https://github.com/adrien-barret/claude-kit --skill auth-review

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: auth-review
Source: https://github.com/adrien-barret/claude-kit/tree/main/project-template/.claude/skills/security/auth-review
Command: npx skills add https://github.com/adrien-barret/claude-kit --skill auth-review

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps security engineers review authentication and authorization design across codebases to identify weaknesses in token handling, session management, and access controls.

Core Features & Use Cases

Identify authentication mechanisms (JWT, OAuth, API keys) and how they are integrated.
Map token issuance, validation, and refresh flows; check for expiration handling and TTLs.
Assess authorization models (RBAC/ABAC) and ensure centralized checks; flag ad-hoc comparisons.
Detect potential privilege escalation risks and IDORs; review CSRF and cookie security settings.
Provide remediation guidance and prioritized risk mitigation for secure design.

Quick Start

Run a security review focusing on the auth layer by scanning for token lifetimes, session cookies, and authorization checks. Generate a concise report with findings and recommended mitigations.

Frequently Asked Questions about auth-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I audit JWT token lifetimes and session management in my codebase?▼

To audit JWT token lifetimes and session management, review token issuance, validation, and refresh flows to verify proper expiration handling, TTL enforcement, and secure cookie flags across your services.

What is the best way to check for RBAC and ABAC authorization weaknesses?▼

Checking RBAC and ABAC authorization weaknesses involves assessing access control models to ensure centralized checks, flagging ad-hoc comparisons, and detecting potential privilege escalation risks or IDORs.

How do I review OAuth integration and API key security for access control?▼

Review OAuth integration and API key security by identifying authentication mechanisms and mapping how they are integrated, ensuring secure key management and validating token issuance flows.

Does this security review cover CSRF protections and cookie security settings?▼

Yes, this security review covers CSRF protections and cookie security settings by systematically checking for proper cookie security flags and validating CSRF protection mechanisms across the auth layer.

How do I generate a risk assessment report for authentication design validation?▼

Generate a risk assessment report for authentication design validation by scanning the auth layer for token lifetimes, session cookies, and authorization checks, producing prioritized remediation guidance and risk mitigation.